@bongos/core 1.20.59 → 1.20.60

package/modules/hall-ui/public/atlas.html

@@ -91,7 +91,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/atlas.js?v=2026-09-02-index" defer></script>

package/modules/hall-ui/public/blockers.html

@@ -50,7 +50,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/board-room.html

@@ -60,7 +60,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-board"></script>

package/modules/hall-ui/public/collab.html

@@ -148,7 +148,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/collab-lib.js?v=2026-09-24-archive"></script>

package/modules/hall-ui/public/commands.html

@@ -54,7 +54,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>

package/modules/hall-ui/public/copy-desk.html

@@ -177,7 +177,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/deploy.html

@@ -74,7 +74,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/diagrams.html

@@ -97,7 +97,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/diagram-viewer.js?v=2026-06-14-diagviewer-1" defer></script>

package/modules/hall-ui/public/drachmae.html

@@ -98,7 +98,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/md-reader.js?v=2026-09-02-mdreader-2"></script>

package/modules/hall-ui/public/fleet.html

@@ -54,7 +54,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/gate.html

@@ -76,7 +76,7 @@
 <div id="gate-modal-root"></div>
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/goal-map.html

@@ -137,7 +137,7 @@
   </div>
 </div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <script src="/builders/palette.js" defer></script>
 
 <script src="/builders/idea-objects.js?v=2026-09-27-split"></script>

package/modules/hall-ui/public/goals.html

@@ -230,7 +230,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>

package/modules/hall-ui/public/government.html

@@ -134,7 +134,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/idea.html

@@ -52,7 +52,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib" defer></script>
 <!-- task-detail.js still owns the #/idea/N and #/blocker/N overlay, so a ref

package/modules/hall-ui/public/ideas.html

@@ -225,7 +225,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- task 1003069 (R08) — the quick-filing form's routed result links a task

package/modules/hall-ui/public/index.html

@@ -106,7 +106,7 @@
 <script src="/builders/brand-apply.js?v=2026-06-27-r75" defer></script>
 <!-- The app shell (sidebar + top bar + view router). Dependency-free; loaded
      BEFORE builders.js so the chrome ids exist when events are wired. -->
-<script src="/builders/shell.js?v=2026-09-30-navback2" defer></script>
+<script src="/builders/shell.js?v=2026-10-01-look" defer></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- task 2166: the shared component kit (window.OTBKit) — pager/ledger/rail.

package/modules/hall-ui/public/modules.html

@@ -101,7 +101,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>

package/modules/hall-ui/public/primer.html

@@ -115,7 +115,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- the shared markdown reader (window.OTBMdReader) — primer.js renders through

package/modules/hall-ui/public/profile.html

@@ -187,7 +187,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before profile.js, which pulls from it. -->

package/modules/hall-ui/public/project-settings.html

@@ -58,7 +58,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/ranks.html

@@ -77,7 +77,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before ranks.js, which pulls from it. -->

package/modules/hall-ui/public/roadmap.html

@@ -41,7 +41,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>

package/modules/hall-ui/public/roster.html

@@ -50,7 +50,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/sessions.html

@@ -99,7 +99,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded BEFORE sessions.js so it can pull from it. -->

package/modules/hall-ui/public/settings.html

@@ -400,7 +400,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page scripts run. -->
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before consuming IIFEs. -->

package/modules/hall-ui/public/shell.js

@@ -442,7 +442,11 @@
 
     el.innerHTML =
       '<div class="app-sidebar__brand"><a class="brand-mark" href="/" id="brand-mark">' +
-        '<span class="brand-mark__dot" aria-hidden="true"></span>' +
+        // A project's logo (ADR 0358, task 1004421) takes the dot's place; the
+        // platform validated it as an https image address before it was pushed.
+        (brand.theme && brand.theme.logo
+          ? '<img class="brand-mark__logo" src="' + esc(brand.theme.logo) + '" alt="" width="24" height="24" decoding="async">'
+          : '<span class="brand-mark__dot" aria-hidden="true"></span>') +
         '<span class="brand-mark__name" id="brand-name"></span></a></div>' +
       '<nav class="app-sidebar__nav" aria-label="Primary">' + groups + '</nav>' +
       '<div class="app-sidebar__foot">' +

package/modules/hall-ui/public/studio.html

@@ -176,7 +176,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- The kit, for its ONE renderer: the full-size ship-time visual figure

package/modules/hall-ui/public/style.css

@@ -561,6 +561,14 @@ main:focus { outline: none; }
   background: none;
   flex-shrink: 0;
 }
+/* A project's logo in the dot's place (ADR 0358): the image is the founder's, so
+   it gets a soft square, never a recolour. */
+.brand-mark__logo {
+  width: 24px; height: 24px;
+  border-radius: 6px;
+  object-fit: contain;
+  flex-shrink: 0;
+}
 .brand-mark__name {
   display: none;
   white-space: nowrap;

package/modules/hall-ui/public/task.html

@@ -57,7 +57,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so task.js can pull from it. -->

package/modules/hall-ui/public/thinking.html

@@ -138,7 +138,7 @@
   </div>
 </div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <script src="/builders/palette.js" defer></script>
 
 <script src="/builders/idea-objects.js?v=2026-09-27-split"></script>

package/modules/hall-ui/public/tweak-editor.html

@@ -140,7 +140,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/brand-holes.js?v=2026-09-29-aqfix"></script>

package/modules/hall-ui/public/watch.html

@@ -162,7 +162,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before watch.js, which pulls from it. -->

package/modules/hall-ui/public/work.html

@@ -171,7 +171,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so work.js can pull from it. -->

package/modules/provisioning/look.js

@@ -0,0 +1,169 @@
+// modules/provisioning/look.js — a project's look, night tint and logo, as the
+// platform stores and pushes them (ADR 0358, task 1004421; spec D2 + D8).
+//
+// `look` and `night_tint` are POLICY settings: they join SETTINGS_VOCAB, ride web.env
+// and a restart applies them, like every other key there (src/hall-look.js reads them
+// on the instance). Their two companions are values, not choices from a list, so they
+// are reserved settings-jsonb keys written only by routes/look.js:
+//
+//   look_accent  a custom look's ONE accent, stored AFTER lookAdjustAccent made it
+//                readable in both modes, so the instance never has to judge it.
+//   logo_url     the content-addressed public address of the stored logo.
+//
+// Neither is in SETTINGS_VOCAB, so the generic settings PATCH cannot write them, and
+// neither leaks through effectiveSettings.
+'use strict';
+
+const crypto = require('node:crypto');
+
+// The style library's looks (modules/ui-design/styles/, ADR 0219) — a test pins this
+// list to the directory — plus `own` (the instance's own pack: today's hall, and the
+// default) and `custom` (one accent over the chrome world).
+const LIBRARY_LOOKS = Object.freeze(['chrome-world', 'expedition', 'grove', 'blueprint']);
+const LOOK_SETTINGS_VOCAB = Object.freeze({
+  look: Object.freeze(['own', ...LIBRARY_LOOKS, 'custom']),
+  night_tint: Object.freeze(['on', 'off']),
+});
+// `own` is today's behaviour. The tint defaults ON (owner D2), and only ever tints a
+// hall that wears a look, so the default changes nothing for a hall that chose none.
+const LOOK_DEFAULTS = Object.freeze({ look: 'own', night_tint: 'on' });
+
+const HEX = /^#[0-9a-f]{6}$/i;
+const LOGO_URL = /^https:\/\/[^\s"'<>()\\]+$/;
+const storedOf = (row) => (row && row.settings && typeof row.settings === 'object' && !Array.isArray(row.settings) ? row.settings : {});
+const lookAccentOf = (row) => (HEX.test(String(storedOf(row).look_accent || '')) ? String(storedOf(row).look_accent).toLowerCase() : '');
+const logoUrlOf = (row) => (LOGO_URL.test(String(storedOf(row).logo_url || '')) ? String(storedOf(row).logo_url) : '');
+
+// The companion env (SETTINGS_COMPANION_ENV): always emitted, empty meaning none, so a
+// value that came and went never leaves a stale line in a patched web.env.
+const LOOK_COMPANION_ENV = Object.freeze({ LOOK_ACCENT: lookAccentOf, LOGO_URL: logoUrlOf });
+
+// The project's look as the manage page and the wizard read it. PURE.
+function lookChoice(row, effective) {
+  return {
+    look: effective.look,
+    night_tint: effective.night_tint,
+    look_accent: lookAccentOf(row) || null,
+    logo_url: logoUrlOf(row) || null,
+  };
+}
+
+// ONE algorithm, two copies: the create wizard and the manage page carry this exact
+// function (modules/public-landing/public/projects.html), and
+// tests/provisioning_look.mjs pins the two texts equal. The founder picks one colour;
+// it must read in both modes, against everything the hall paints with it:
+//   * the dark ink the hall puts on an accent fill (#2a1305, --accent-on);
+//   * the light mode's derived accent ink (45% accent into #240e00) on the chrome
+//     world's paper and card;
+//   * the accent itself as text on the black grounds and on the tinted ones
+//     (src/night-tint.js, which mixes this same accent in);
+//   * the hall's info chip on the tinted card (--info on --info-weak, both mixed from
+//     the chrome world's sea and that card) — the thinnest pair a tint moves.
+// 4.6 rather than 4.5 leaves rounding room; the info chip is held at exactly 4.5,
+// computed as tests/hall_tokens.mjs computes it, because 4.6 there would move library
+// accents that already pass. A colour that passes comes back as it
+// was; one that fails keeps its hue and saturation and moves to the nearest
+// lightness that passes. null only for a value that is not #rrggbb.
+function lookAdjustAccent(hex) {
+  var m = /^#?([0-9a-f]{6})$/i.exec(String(hex || '').trim());
+  if (!m) return null;
+  var n = parseInt(m[1], 16);
+  var rgb = [(n >> 16) & 255, (n >> 8) & 255, n & 255];
+  function mix(a, p, b) { return [0, 1, 2].map(function (i) { return a[i] * p + b[i] * (1 - p); }); }
+  function lum(c) {
+    var v = c.map(function (x) { x /= 255; return x <= 0.03928 ? x / 12.92 : Math.pow((x + 0.055) / 1.055, 2.4); });
+    return 0.2126 * v[0] + 0.7152 * v[1] + 0.0722 * v[2];
+  }
+  function ratio(a, b) { var x = lum(a), y = lum(b); return (Math.max(x, y) + 0.05) / (Math.min(x, y) + 0.05); }
+  function reads(c) {
+    var ink = mix(c, 0.45, [36, 14, 0]);
+    var darks = [[0, 0, 0], [16, 16, 18], mix(c, 0.06, [0, 0, 0]), mix(c, 0.05, [16, 16, 18])];
+    var info = mix([91, 111, 208], 0.8, [255, 255, 255]);
+    return ratio([42, 19, 5], c) >= 4.6 && ratio(ink, [237, 236, 238]) >= 4.6 && ratio(ink, [251, 250, 252]) >= 4.6 &&
+      darks.every(function (d) { return ratio(c, d) >= 4.6; }) && ratio(info, mix(info, 0.14, darks[3])) >= 4.5;
+  }
+  function toHex(c) { return '#' + c.map(function (x) { var s = Math.round(x).toString(16); return s.length < 2 ? '0' + s : s; }).join(''); }
+  var r = rgb[0] / 255, g = rgb[1] / 255, b = rgb[2] / 255;
+  var max = Math.max(r, g, b), min = Math.min(r, g, b), l = (max + min) / 2, h = 0, s = 0, d = max - min;
+  if (d) {
+    s = l > 0.5 ? d / (2 - max - min) : d / (max + min);
+    h = max === r ? (g - b) / d + (g < b ? 6 : 0) : max === g ? (b - r) / d + 2 : (r - g) / d + 4;
+    h /= 6;
+  }
+  function hsl(L) {
+    function f(p, q, t) { t = (t + 1) % 1; return t < 1 / 6 ? p + (q - p) * 6 * t : t < 1 / 2 ? q : t < 2 / 3 ? p + (q - p) * (2 / 3 - t) * 6 : p; }
+    if (!s) return [L * 255, L * 255, L * 255];
+    var q = L < 0.5 ? L * (1 + s) : L + s - L * s, p = 2 * L - q;
+    return [f(p, q, h + 1 / 3) * 255, f(p, q, h) * 255, f(p, q, h - 1 / 3) * 255];
+  }
+  if (reads(rgb)) return { hex: toHex(rgb), adjusted: false };
+  for (var step = 1; step <= 200; step++) {
+    var tries = [l + step / 200, l - step / 200];
+    for (var t = 0; t < 2; t++) {
+      if (tries[t] < 0 || tries[t] > 1) continue;
+      var c = hsl(tries[t]).map(Math.round);
+      if (reads(c)) return { hex: toHex(c), adjusted: true };
+    }
+  }
+  return null;
+}
+
+// ── the logo ────────────────────────────────────────────────────────────────
+// PNG, JPEG or WebP, at most 256 KB, checked by its bytes. Never SVG: an SVG is a
+// document, and a document can carry script. The task-visuals screen
+// (modules/lifecycle/task-visuals.js) is the precedent; this is its narrower cousin.
+const LOGO_MAX_BYTES = 256 * 1024;
+const LOGO_TYPES = Object.freeze({ 'image/png': 'png', 'image/jpeg': 'jpg', 'image/webp': 'webp' });
+const LOGO_MIME = Object.freeze({ png: 'image/png', jpg: 'image/jpeg', webp: 'image/webp' });
+
+function sniffLogo(buf) {
+  if (!buf || buf.length < 12) return null;
+  if (buf[0] === 0x89 && buf[1] === 0x50 && buf[2] === 0x4e && buf[3] === 0x47) return 'png';
+  if (buf[0] === 0xff && buf[1] === 0xd8 && buf[2] === 0xff) return 'jpg';
+  if (buf[0] === 0x52 && buf[1] === 0x49 && buf[2] === 0x46 && buf[3] === 0x46 &&
+      buf[8] === 0x57 && buf[9] === 0x45 && buf[10] === 0x42 && buf[11] === 0x50) return 'webp';
+  return null;
+}
+
+// { ok:true, ext, mime, sha } or { ok:false, reason, message }. PURE; never throws.
+function screenLogo(buf, contentType) {
+  const declared = LOGO_TYPES[String(contentType || '').split(';')[0].trim().toLowerCase()];
+  if (!declared) return { ok: false, reason: 'bad_type', message: 'A logo must be a PNG, JPEG or WebP image.' };
+  if (!buf || !buf.length) return { ok: false, reason: 'empty', message: 'The image is empty.' };
+  if (buf.length > LOGO_MAX_BYTES) {
+    return { ok: false, reason: 'too_big', message: `The image is ${Math.round(buf.length / 1024)} KB — a logo can be at most ${LOGO_MAX_BYTES / 1024} KB.` };
+  }
+  const ext = sniffLogo(buf);
+  if (ext !== declared) return { ok: false, reason: 'sniff_mismatch', message: 'The file is not really the kind of image it says it is.' };
+  return { ok: true, ext, mime: LOGO_MIME[ext], sha: crypto.createHash('sha256').update(buf).digest('hex') };
+}
+
+// The stored logo's public file name: content-addressed, so the address changes when
+// the image does (no stale cache), is unguessable, and names no project.
+const logoFileName = (sha, ext) => `${sha}.${ext}`;
+const LOGO_FILE = /^([0-9a-f]{64})\.(png|jpg|webp)$/;
+
+// The logo's three statements. The route calls them through this module object, so a
+// test can stand in for the database without one.
+async function upsertLogo(db, instanceId, { sha, ext, mime }, buf) {
+  await db.query(
+    `INSERT INTO provisioning_logos (instance_id, sha256, ext, mime, bytes)
+     VALUES ($1, $2, $3, $4, $5)
+     ON CONFLICT (instance_id) DO UPDATE
+       SET sha256 = EXCLUDED.sha256, ext = EXCLUDED.ext, mime = EXCLUDED.mime, bytes = EXCLUDED.bytes, updated_at = now()`,
+    [instanceId, sha, ext, mime, buf]);
+}
+async function deleteLogo(db, instanceId) {
+  await db.query('DELETE FROM provisioning_logos WHERE instance_id = $1', [instanceId]);
+}
+async function readLogo(db, sha, ext) {
+  const { rows } = await db.query('SELECT mime, bytes FROM provisioning_logos WHERE sha256 = $1 AND ext = $2 LIMIT 1', [sha, ext]);
+  return rows[0] || null;
+}
+
+module.exports = {
+  upsertLogo, deleteLogo, readLogo,
+  LIBRARY_LOOKS, LOOK_SETTINGS_VOCAB, LOOK_DEFAULTS, LOOK_COMPANION_ENV,
+  lookChoice, lookAdjustAccent, lookAccentOf, logoUrlOf,
+  LOGO_MAX_BYTES, LOGO_MIME, screenLogo, sniffLogo, logoFileName, LOGO_FILE,
+};

package/modules/provisioning/migrations/provisioning_034_project_logo.sql

@@ -0,0 +1,35 @@
+-- provisioning_034_project_logo.sql — a project's logo, kept by the platform
+-- (task 1004421, BV2.PS06; ADR 0358 D6; goal 1000121, spec docs/specs/bongos-v2-project-startup.md).
+--
+-- WHY THIS EXISTS. A founder can give a project a logo at creation, and an existing
+-- project's owner can add one on its manage page (spec D8). The hall shows it in its mark
+-- and uses it as the browser tab's icon, and the hall is a different machine from the
+-- platform — so the platform keeps the image and serves it at a public address the hall
+-- is told (the LOGO_URL setting companion). An instance has no shared disk with the
+-- platform, and the platform's own disk is replaced on every core upgrade, so the bytes
+-- live here.
+--
+-- WHAT IT ADDS. One row per project that has a logo:
+--   instance_id  the project (provisioning_instances.id); deleting the project row drops it.
+--   sha256       hex digest of the bytes. The public address is <sha256>.<ext>, so it is
+--                content-addressed: it changes when the image does, names no project and
+--                cannot be guessed.
+--   ext / mime   png | jpg | webp, from the bytes' own magic number (never SVG, which is a
+--                document that can carry script). The route refuses anything else.
+--   bytes        the image itself, at most 256 KB (enforced by the route).
+--
+-- Additive and namespaced (ADR 0083): no down-migration, idempotent — safe to re-run.
+
+BEGIN;
+
+CREATE TABLE IF NOT EXISTS provisioning_logos (
+  instance_id bigint  PRIMARY KEY REFERENCES provisioning_instances(id) ON DELETE CASCADE,
+  sha256      text        NOT NULL,
+  ext         text        NOT NULL CHECK (ext IN ('png', 'jpg', 'webp')),
+  mime        text        NOT NULL,
+  bytes       bytea       NOT NULL,
+  updated_at  timestamptz NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS provisioning_logos_sha256 ON provisioning_logos (sha256);
+
+COMMIT;

package/modules/provisioning/module.json

@@ -19,7 +19,8 @@
       "core-upgrade",
       "env-manifest",
       "repo-private",
-      "render-standup"
+      "render-standup",
+      "look"
     ],
     "migrations": true,
     "pollers": [

package/modules/provisioning/provisioning.js

@@ -24,6 +24,7 @@ const { normalizeModuleSelection, effectiveModules } = require('./starter-bundle
 // projection both have to read them.
 const { PLANET_PHYSICS_QUESTIONS, canonicalAnswer } = require('./planet-physics');
 const { softLimitsFor } = require('./soft-limits');
+const { LOOK_SETTINGS_VOCAB, LOOK_DEFAULTS, LOOK_COMPANION_ENV } = require('./look');
 
 // ---------------------------------------------------------------------------
 // Constants (mirror the CHECK constraints in provisioning_001_tables.sql)
@@ -198,7 +199,7 @@ const SETTINGS_VOCAB = Object.freeze({
   visibility: ['public', 'private', 'stealth'],
   join_grant: ['view', 'apply', 'full'],
   artist_gate: ['off', 'advisory', 'strict'],
-  spend_payer: ['none', 'project', 'builder'],
+  spend_payer: ['none', 'project', 'builder'], ...LOOK_SETTINGS_VOCAB, // + the look, ADR 0358 (look.js)
 });
 // Default = today's behavior on every axis, including the join door: ADR 0182's
 // migration gives the hub column the same `public` default, "existing rows keep
@@ -206,7 +207,7 @@ const SETTINGS_VOCAB = Object.freeze({
 // owner's ruling rather than the status quo — see the note above it.
 const DEFAULT_SETTINGS = Object.freeze({
   platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full',
-  artist_gate: 'strict', spend_payer: 'none',
+  artist_gate: 'strict', spend_payer: 'none', ...LOOK_DEFAULTS,
 });
 
 // The project's PLANET (task 1003347, direction record §16): how the platform
@@ -517,7 +518,7 @@ function settingsEnvVars(row, prefix) {
 // cutoff and every unresolved review counts, which is the right answer for a
 // project that has been strict since it stood up.
 const SETTINGS_COMPANION_ENV = Object.freeze({
-  ARTIST_GATE_SINCE: (row) => artistGateStrictSince(row) || '',
+  ARTIST_GATE_SINCE: (row) => artistGateStrictSince(row) || '', ...LOOK_COMPANION_ENV, // + accent, logo (look.js)
 });
 
 // The web.env block the runner writes at STANDUP (task 1003139): a comment that